UBUNTU-CVE-2026-125220: Medium severity ubuntu/ffmpeg vulnerability
FFmpeg through 9.0.2 contains a deadlock vulnerability in mimicdecodeframe() in libavcodec/mimic.c that fails to report frame progress when initgetbits8() fails. Attackers can supply a crafted file with an oversized Mimic intra frame followed by inter frames to hang frame-threaded decoding indefinitely.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using Ubuntu's FFmpeg package are exposed when they decode attacker-supplied Mimic video content with frame-threaded decoding enabled. The impact is an indefinite hang of the decoding operation, affecting availability rather than confidentiality or integrity.
What does an attacker need to trigger the hang?
An attacker needs to provide a crafted file containing an oversized Mimic intra frame followed by inter frames, and induce the target to decode it. The vector is local and requires user interaction according to the supplied severity data.
How can I tell whether a decoding hang may be related to this vulnerability?
The relevant symptom is FFmpeg decoding that hangs indefinitely while processing Mimic content, particularly a file with an oversized intra frame followed by inter frames under frame-threaded decoding. The provided data identifies affected FFmpeg versions only as through 9.0.2.